Upstream updates detected — 2026-04-06

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

context7

• 1 new commit(s) since last check
• Latest: 42dedb3 — docs: add Policies section to on-premise documentation for public documentation access control (#2394)
• Recent commits:
• 42dedb3 docs: add Policies section to on-premise documentation for public documentation access control (#2394)
• 6cba6fb docs: update API guide and OpenAPI schema and reorder the api docs (#2388)
• 89d4862 fix(cli): use GITHUB_TOKEN for skill downloads to avoid rate limits (#2370)
• 2273d52 docs: add website filters (#2333)
• b4f77af docs: add server URL reference to README and all-clients page (#2347)

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

context7

• New release: @upstash/context7-tools-ai-sdk@0.2.3 (was ctx7@0.3.9)
• Release notes:

### Patch Changes

-   8322879: Improve resolve libryar id tool prompt to provide the libraryName query with proper format

• 3 new commit(s) since last check
• Latest: 36463ad — chore(release): version packages (#2351)
• Recent commits:
• 36463ad chore(release): version packages (#2351)
• 8322879 docs: enhance library name guidelines in CLI and documentation (#2408)
• fb29170 feat(cli): add Gemini CLI support to setup command (#2406)
• 42dedb3 docs: add Policies section to on-premise documentation for public documentation access control (#2394)
• 6cba6fb docs: update API guide and OpenAPI schema and reorder the api docs (#2388)

superpowers

• 2 new commit(s) since last check
• Latest: 917e5f5 — Fix Discord invite link
• Recent commits:
• 917e5f5 Fix Discord invite link
• a6b1a1f Update Discord invite link
• b7a8f76 Merge pull request #1029 from obra/readme-release-announcements
• 4b1b20f Add detailed Discord description to Community section
• eeaf2ad Add release announcements link, consolidate Community section

playwright-mcp

• New release: v0.0.70 (was none)
• Release notes:

- Maintenance release off 1.59 branch point

• ? new commit(s) since last check
• Latest: 63b18de — fix(extension): point version mismatch error to Chrome Web Store (#1524)
• Recent commits:
• 63b18de fix(extension): point version mismatch error to Chrome Web Store (#1524)
• ca1783b feat(extension): add workflow for publishing to Chrome Web Store (#1523)
• 4047ce8 chore(extension): mark v0.1.0 (#1522)
• 0c72153 docs: add Junie installation instructions (#1519)
• 81a038b chore: bump vite version (#1521)

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Check if Playwright MCP API or capabilities have changed
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

playwright-mcp

• 1 new commit(s) since last check
• Latest: 233e4eb — test(extension): properly delete env vars in fixture cleanup (#1526)
• Recent commits:
• 233e4eb test(extension): properly delete env vars in fixture cleanup (#1526)
• 63b18de fix(extension): point version mismatch error to Chrome Web Store (#1524)
• ca1783b feat(extension): add workflow for publishing to Chrome Web Store (#1523)
• 4047ce8 chore(extension): mark v0.1.0 (#1522)
• 0c72153 docs: add Junie installation instructions (#1519)

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Check if Playwright MCP API or capabilities have changed
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

context7

• New release: ctx7@0.3.11 (was @upstash/context7-tools-ai-sdk@0.2.3)
• Release notes:

### Patch Changes

-   bc8eaf1: Add `--all-agents` and `--yes` support to `ctx7 skills install` for non-interactive multi-agent installs.

• 2 new commit(s) since last check
• Latest: 5f108ec — chore(release): version packages (#2425)
• Recent commits:
• 5f108ec chore(release): version packages (#2425)
• bc8eaf1 Add all-agents option for ctx7 skills install (#2424)
• 36463ad chore(release): version packages (#2351)
• 8322879 docs: enhance library name guidelines in CLI and documentation (#2408)
• fb29170 feat(cli): add Gemini CLI support to setup command (#2406)

playwright-mcp

• 1 new commit(s) since last check
• Latest: 8f8f8cd — feat(extension): support multiple tabs over a single connection (#1535)
• Recent commits:
• 8f8f8cd feat(extension): support multiple tabs over a single connection (#1535)
• 233e4eb test(extension): properly delete env vars in fixture cleanup (#1526)
• 63b18de fix(extension): point version mismatch error to Chrome Web Store (#1524)
• ca1783b feat(extension): add workflow for publishing to Chrome Web Store (#1523)
• 4047ce8 chore(extension): mark v0.1.0 (#1522)

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Check if Playwright MCP API or capabilities have changed
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

context7

• 1 new commit(s) since last check
• Latest: 09d05bc — docs: add new integrations for Factory AI, Mastra, and Tembo with corresponding setup instructions and images (#2428)
• Recent commits:
• 09d05bc docs: add new integrations for Factory AI, Mastra, and Tembo with corresponding setup instructions and images (#2428)
• 5f108ec chore(release): version packages (#2425)
• bc8eaf1 Add all-agents option for ctx7 skills install (#2424)
• 36463ad chore(release): version packages (#2351)
• 8322879 docs: enhance library name guidelines in CLI and documentation (#2408)

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Check if Playwright MCP API or capabilities have changed
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

context7

• 1 new commit(s) since last check
• Latest: 00833f9 — fix(mcp): preserve default CAs with NODE_EXTRA_CA_CERTS (#2432)
• Recent commits:
• 00833f9 fix(mcp): preserve default CAs with NODE_EXTRA_CA_CERTS (#2432)
• 09d05bc docs: add new integrations for Factory AI, Mastra, and Tembo with corresponding setup instructions and images (#2428)
• 5f108ec chore(release): version packages (#2425)
• bc8eaf1 Add all-agents option for ctx7 skills install (#2424)
• 36463ad chore(release): version packages (#2351)

playwright-mcp

• 2 new commit(s) since last check
• Latest: d378215 — chore(deps-dev): bump @hono/node-server from 1.19.10 to 1.19.13 (#1527)
• Recent commits:
• d378215 chore(deps-dev): bump @hono/node-server from 1.19.10 to 1.19.13 (#1527)
• 3b7ac70 chore(deps-dev): bump hono from 4.12.7 to 4.12.12 (#1528)
• 8f8f8cd feat(extension): support multiple tabs over a single connection (#1535)
• 233e4eb test(extension): properly delete env vars in fixture cleanup (#1526)
• 63b18de fix(extension): point version mismatch error to Chrome Web Store (#1524)

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Check if Playwright MCP API or capabilities have changed
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

context7

• New release: @upstash/context7-mcp@2.1.8 (was ctx7@0.3.11)
• Release notes:

### Patch Changes

-   00833f9: Preserve Node's default trusted CAs when `NODE_EXTRA_CA_CERTS` is configured, and add a regression test for custom CA loading.

• 2 new commit(s) since last check
• Latest: c31528d — chore(release): version packages (#2433)
• Recent commits:
• c31528d chore(release): version packages (#2433)
• 33f2338 Handle Codex CLI sandbox DNS failures in setup (#2449)
• 00833f9 fix(mcp): preserve default CAs with NODE_EXTRA_CA_CERTS (#2432)
• 09d05bc docs: add new integrations for Factory AI, Mastra, and Tembo with corresponding setup instructions and images (#2428)
• 5f108ec chore(release): version packages (#2425)

lightrag

• New release: v1.4.14 (was none)
• Release notes:

## What's New
* feat(setup): **support Atlas Local Docker for Mongo vector storage** by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2925
* perf: batch graph operations in ainsert_custom_kg for large-scale imports by @nszhsl in https://github.com/HKUDS/LightRAG/pull/2910
* examples: add AG2 multi-agent demo with LightRAG retrieval by @faridun-ag2 in https://github.com/HKUDS/LightRAG/pull/2867

## What's Fixed
* fix: remove redundant file_path_placeholder lookup in _merge_edges_then_upsert by @jwchmodx in https://github.com/HKUDS/LightRAG/pull/2877
* chore: remove dead config.ini / configparser code by @jwchmodx in https://github.com/HKUDS/LightRAG/pull/2887
* chore: remove dead OLLAMA_NUM_CTX / args.ollama_num_ctx assignment by @jwchmodx in https://github.com/HKUDS/LightRAG/pull/2888
* fix(webui): resolve all bun run lint errors in lightrag_webui by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2891
* chore(webui): migrate ESLint stylistic plugin by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2893
* docs(readme): restructure documentation and consolidate core api by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2896
* fix pipeline status history trimming by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2897
* fix: Corrected exception handling for LLM API timeouts where the subclass incorrectly passes keyword args by @hillct in https://github.com/HKUDS/LightRAG/pull/2902
* Improve LLM API failure diagnostics by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2903
* docs: deprecate config.ini in documentation by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2905
* fix(auth): prevent JWT algorithm confusion attack (GHSA-8ffj-4hx4-9pgf) by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2907
* fix(api): add missing metadata field in /query/data error response by @lawrence3699 in https://github.com/HKUDS/LightRAG/pull/2923
* fix(utils): **prevent remove_think_tags from truncating responses with embedded <think> tags** by @sjhddh in https://github.com/HKUDS/LightRAG/pull/2900
* fix(opensearch): **ensure consistent by lazy index refresh and real-time edge lookups** by @danielaskdd in https://github.com/HKUDS/LightRAG/pull/2926

• ? new commit(s) since last check
• Latest: 5a2694e — Update bun.lock
• Recent commits:
• 5a2694e Update bun.lock
• 99360ef Bump API version to 0285
• 27eb61f Merge pull request #2928 from danielaskdd/fix/get_knowledge_graph
• a92bb07 Merge pull request #2927 from HKUDS/dependabot/github_actions/github-actions-556be15a16
• 7cd87bb Fix linting

everything-claude-code

• New release: v1.10.0 (was none)
• Release notes:

## ECC 1.10.0

### What This Release Focuses On
- Harness reliability and hook stability across Claude Code, Cursor, OpenCode, and Codex
- Stronger eval-driven workflows and quality gates
- Better operator UX for autonomous loop execution

### Notable Changes
- Session persistence and hook lifecycle fixes
- Expanded skills and command coverage for harness performance work
- Improved release-note generation and changelog hygiene

### Notes
- For migration tips and compatibility notes, see README and CHANGELOG.


<!-- Release notes generated using configuration in .github/release.yml at v1.10.0 -->


## New Contributors

• ? new commit(s) since last check
• Latest: e0ddb33 — Merge pull request #1367 from ozoz5/feat/gateguard
• Recent commits:
• e0ddb33 Merge pull request #1367 from ozoz5/feat/gateguard
• 85e331e Merge pull request #1369 from affaan-m/dependabot/github_actions/pnpm/action-setup-6.0.0
• 5eedc8a Merge pull request #1377 from Anish29801/feat/dashboard-gui
• c64cc69 Merge pull request #1363 from gnpthbalaji/feat/accessibility
• 6c67566 fix: keep gateguard session state alive

ui-ux-pro-max

• New release: v2.5.0 (was none)
• Release notes:

## What's New

### New Skills
- **`banner-design`** - Design banners for social media, ads, website heroes, and print
- **`slides`** - Create strategic HTML presentations with Chart.js and design tokens
- **`ui-styling`** - Style UIs with shadcn/ui, Tailwind CSS, and canvas-based visual design
- **`design-system`** - Token architecture, component specs, and slide generation
- **`design`** - Brand identity, logo generation (55 styles), CIP mockups
- **`brand`** - Voice, visual identity, messaging frameworks, asset management

### Data Expansion
- **161 product types** with reasoning rules
- **161 color palettes** by product type
- **99 UX guidelines** with priority-based recommendations
- **1923 Google Fonts** searchable database
- **25 chart types** with library recommendations

### Improvements
- Translated all Chinese text to English in SKILL.md
- Synced CLI assets with source of truth

• ? new commit(s) since last check
• Latest: b7e3af8 — Merge pull request #184 from Jenser77/feat/design-system-visual-improvements
• Recent commits:
• b7e3af8 Merge pull request #184 from Jenser77/feat/design-system-visual-improvements
• 7faef3e Merge pull request #191 from amyragan3297/amyragan3297-patch-1
• 4255c21 Merge pull request #209 from nextlevelbuilder/feat/enhancement-issues
• 01944c4 merge: resolve conflicts with main branch
• 49c9fbe Merge pull request #205 from Krishna-Modi12/feat/threejs-stack

karpathy-skills

• ? new commit(s) since last check
• Latest: aa4467f — Merge pull request #18 from back1ply/fix/plugin-skill-path
• Recent commits:
• aa4467f Merge pull request #18 from back1ply/fix/plugin-skill-path
• 68b67a5 Fix plugin.json schema validation errors
• 3cf049f Add marketplace.json and fix plugin structure
• b26f4c3 Fix plugin skill path and update install instructions
• 6077083 Merge pull request feat: auto-PR on upstream changes, fix unknown states, add caveman (v1.5.0) #7 from HOLYKEYZ/main

n8n-mcp

• New release: v2.47.7 (was none)
• Release notes:

# Release v2.47.7

Generating release notes from v2.47.6 to HEAD
### 🐛 Bug Fixes

- Strict validator false positives for Merge, Code, loops, expressions (v2.47.7) (#725) (217d737)

### 📚 Documentation

- Add Incident Response Plan (#723) (4072bf2)
- Restructure README into focused landing page (#720) (78768dd)

---

**Release Statistics:**
- 3 commits
- 1 contributor
- Contributors: Romuald Członkowski

---

• ? new commit(s) since last check
• Latest: 217d737 — fix: strict validator false positives for Merge, Code, loops, expressions (v2.47.7) (#725)
• Recent commits:
• 217d737 fix: strict validator false positives for Merge, Code, loops, expressions (v2.47.7) (#725)
• 4072bf2 docs: add Incident Response Plan (#723)
• 78768dd docs: restructure README into focused landing page (#720)
• 4b161b6 Merge commit from fork
• ca9d4b3 Merge commit from fork

claude-mem

• New release: v12.1.0 (was none)
• Release notes:

## Knowledge Agents

Build queryable AI "brains" from your claude-mem observation history. Compile a filtered slice of your past work into a corpus, prime it into a Claude session, and ask questions conversationally — getting synthesized, grounded answers instead of raw search results.

### New Features

- **Knowledge Agent system** — full lifecycle: build, prime, query, reprime, rebuild, delete
- **6 new MCP tools**: `build_corpus`, `list_corpora`, `prime_corpus`, `query_corpus`, `rebuild_corpus`, `reprime_corpus`
- **8 new HTTP API endpoints** on the worker service (`/api/corpus/*`)
- **CorpusBuilder** — searches observations, hydrates full records, calculates stats, persists to `~/.claude-mem/corpora/`
- **CorpusRenderer** — renders observations into full-detail prompt text for the 1M token context window
- **KnowledgeAgent** — manages Agent SDK sessions with session resume for multi-turn Q&A
- **Auto-reprime** — expired sessions are automatically reprimed and retried (only for session errors, not all failures)
- **Knowledge agent skill** (`/knowledge-agent`) for guided corpus creation

### Security & Robustness

- Path traversal prevention in CorpusStore (alphanumeric name validation + resolved path check)
- System prompt hardened against instruction injection from untrusted corpus content
- Runtime name validation on all MCP corpus tool handlers

• ? new commit(s) since last check
• Latest: cde4faa — docs: update CHANGELOG.md for v12.1.0
• Recent commits:
• cde4faa docs: update CHANGELOG.md for v12.1.0
• b701bf2 chore: bump version to 12.1.0
• c648d5d feat: Knowledge Agents — queryable corpora from claude-mem (#1653)
• 07be61c feat: support ANTHROPIC_BASE_URL in EnvManager (#1627)
• f7fd222 fix: rebuild FTS5 index after bulk observation import (fixes #1631) (#1632)

voicemode

• New release: v8.5.1 (was none)
• Release notes:

### Added

- **Show-me plugin in marketplace** - Added show-me as an external plugin (source: mbailey/show-me) to the VoiceMode plugin marketplace

### Fixed

- **Pass WHISPER_LANGUAGE config to STT API** ([#253](https://github.com/mbailey/voicemode/pull/253) by @htrex) - The `VOICEMODE_WHISPER_LANGUAGE` config existed but was never passed to the transcription API. Local whisper.cpp defaults to English when no language parameter is given, producing incorrect transcriptions for non-English audio. Now passes `language="auto"` explicitly to whisper.cpp and handles the OpenAI API difference (omit parameter for auto-detect)

### Changed

- **Parallel tool calls guidance** - VoiceMode skill now documents the "speak + act in parallel" pattern for zero dead air during voice conversations, with examples of when to use parallel vs sequential tool calls


## Installation

### Quick Start (Recommended)

```bash
# Install UV package manager (if not already installed)

• ? new commit(s) since last check
• Latest: c8100b2 — Merge branch 'feat/VM-992-connect-auth-cli'
• Recent commits:
• c8100b2 Merge branch 'feat/VM-992-connect-auth-cli'
• ecb678f feat: restore voicemode connect auth CLI commands (VM-992)
• 18acb24 plugin release: 8.5.1p1
• db9b46c Merge branch 'fix/vm-958-remove-stale-hook-refs'
• 88df00c fix: remove stale Connect hook references from plugin.json (VM-958)

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Check if Playwright MCP API or capabilities have changed
• Check if claude-mem MCP tool names or hook schema have changed
• Check if UI UX Pro Max, n8n-MCP, VoiceMode, Everything Claude Code, LightRAG, or Karpathy Skills have breaking changes
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

context7

• New release: ctx7@0.3.13 (was @upstash/context7-mcp@2.1.8)
• Release notes:

### Patch Changes

-   3f6e310: Fix skill installation path validation on Windows so valid files inside the target directory are not rejected due to backslash-separated resolved paths.

• 2 new commit(s) since last check
• Latest: c850669 — chore(release): version packages (#2453)
• Recent commits:
• c850669 chore(release): version packages (#2453)
• 3f6e310 fix: skill installation path check compatibility for Windows (#2441)
• c31528d chore(release): version packages (#2433)
• 33f2338 Handle Codex CLI sandbox DNS failures in setup (#2449)
• 00833f9 fix(mcp): preserve default CAs with NODE_EXTRA_CA_CERTS (#2432)

lightrag

• 8 new commit(s) since last check
• Latest: a780000 — Merge pull request #2933 from danielaskdd/feat/pgvector-auto-enable
• Recent commits:
• a780000 Merge pull request #2933 from danielaskdd/feat/pgvector-auto-enable
• e48a992 fix(postgres): reject conflicting shared vector settings
• 5d70309 refactor(postgres): derive enable_vector from vector_storage, drop env var
• aa28444 Fix linting
• 08fc9f3 fix(api): auto-resolve postgres vector setting

karpathy-skills

• 1 new commit(s) since last check
• Latest: fb8fdb0 — Add Multica project link at the top of README (#51)
• Recent commits:
• fb8fdb0 Add Multica project link at the top of README (#51)
• aa4467f Merge pull request #18 from back1ply/fix/plugin-skill-path
• 68b67a5 Fix plugin.json schema validation errors
• 3cf049f Add marketplace.json and fix plugin structure
• b26f4c3 Fix plugin skill path and update install instructions

n8n-mcp

• 1 new commit(s) since last check
• Latest: 3cd2e48 — fix(ci): add auth header to Docker MCP endpoint test (#726)
• Recent commits:
• 3cd2e48 fix(ci): add auth header to Docker MCP endpoint test (#726)
• 217d737 fix: strict validator false positives for Merge, Code, loops, expressions (v2.47.7) (#725)
• 4072bf2 docs: add Incident Response Plan (#723)
• 78768dd docs: restructure README into focused landing page (#720)
• 4b161b6 Merge commit from fork

playwright-mcp

• 1 new commit(s) since last check
• Latest: 60a1465 — test(extension): exercise both protocol v1 and v2 via projects (#1544)
• Recent commits:
• 60a1465 test(extension): exercise both protocol v1 and v2 via projects (#1544)
• d378215 chore(deps-dev): bump @hono/node-server from 1.19.10 to 1.19.13 (#1527)
• 3b7ac70 chore(deps-dev): bump hono from 4.12.7 to 4.12.12 (#1528)
• 8f8f8cd feat(extension): support multiple tabs over a single connection (#1535)
• 233e4eb test(extension): properly delete env vars in fixture cleanup (#1526)

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Check if Playwright MCP API or capabilities have changed
• Check if claude-mem MCP tool names or hook schema have changed
• Check if UI UX Pro Max, n8n-MCP, VoiceMode, Everything Claude Code, LightRAG, or Karpathy Skills have breaking changes
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

context7

• 1 new commit(s) since last check
• Latest: 0627b71 — CTX7-1531: Create kiro power (#2456)
• Recent commits:
• 0627b71 CTX7-1531: Create kiro power (#2456)
• c850669 chore(release): version packages (#2453)
• 3f6e310 fix: skill installation path check compatibility for Windows (#2441)
• c31528d chore(release): version packages (#2433)
• 33f2338 Handle Codex CLI sandbox DNS failures in setup (#2449)

lightrag

• 28 new commit(s) since last check
• Latest: 157c331 — 💄 style(lightrag): fix code formatting and update TypeScript target
• Recent commits:
• 157c331 💄 style(lightrag): fix code formatting and update TypeScript target
• 2ff52eb Merge branch 'KirillCh143/main'
• 121e483 ♻️ refactor(openai): move embedding base64 env var to module level
• dabb503 Merge branch 'main' into KirillCh143/main
• 0cde488 Merge pull request #2940 from danielaskdd/feat/cosign-docker-image

vercel-agent-skills

• 4 new commit(s) since last check
• Latest: 47863b2 — Merge pull request #227 from vercel-labs/shu/rBVLn
• Recent commits:
• 47863b2 Merge pull request #227 from vercel-labs/shu/rBVLn
• dc8367e update example
• 6938f37 Merge pull request #226 from vercel-labs/shu/vPV6R
• 805687f new bundler skill
• 73140fc Refine react-view-transition skill

everything-claude-code

• 24 new commit(s) since last check
• Latest: 7eb7c59 — Merge pull request #1448 from affaan-m/fix/manual-release-dispatch
• Recent commits:
• 7eb7c59 Merge pull request #1448 from affaan-m/fix/manual-release-dispatch
• 8b5c0c1 fix: allow manual release workflow dispatch
• c1e7a27 Merge pull request #1446 from affaan-m/fix/release-publish-and-migration-docs
• 5427c27 Merge pull request #1445 from affaan-m/fix/plugin-installed-hook-root-resolution
• b5c4d2b fix: wire npm auth into release publish

superpowers

• 10 new commit(s) since last check
• Latest: f9b088f — Merge pull request #1165 from obra/mirror-codex-plugin-tooling
• Recent commits:
• f9b088f Merge pull request #1165 from obra/mirror-codex-plugin-tooling
• bc25777 sync-to-codex-plugin: anchor EXCLUDES patterns to source root
• bcdd7fa sync-to-codex-plugin: exclude assets/, add --bootstrap flag
• 6149f36 sync-to-codex-plugin: align plugin.json heredoc with current live shape
• 777a977 sync-to-codex-plugin: mirror CODE_OF_CONDUCT.md, drop agents/openai.yaml overlay

n8n-mcp

• New release: v2.47.8 (was v2.47.7)
• Release notes:

# Release v2.47.8

Generating release notes from v2.47.7 to HEAD
### 🐛 Bug Fixes

- Parse JSON-stringified workflow params in MCP schemas (v2.47.8, #611) (#727) (2148d80)

### 📝 Other Changes

- fix(ci): add auth header to Docker MCP endpoint test (#726) (3cd2e48)

---

**Release Statistics:**
- 2 commits
- 1 contributor
- Contributors: Romuald Członkowski

---

• 1 new commit(s) since last check
• Latest: 2148d80 — fix: parse JSON-stringified workflow params in MCP schemas (v2.47.8, #611) (#727)
• Recent commits:
• 2148d80 fix: parse JSON-stringified workflow params in MCP schemas (v2.47.8, #611) (#727)
• 3cd2e48 fix(ci): add auth header to Docker MCP endpoint test (#726)
• 217d737 fix: strict validator false positives for Merge, Code, loops, expressions (v2.47.7) (#725)
• 4072bf2 docs: add Incident Response Plan (#723)
• 78768dd docs: restructure README into focused landing page (#720)

claude-mem

• New release: v12.1.2 (was v12.1.0)
• Release notes:

## Community PRs merged (15)

**Runtime & reliability**
- #1698 Reap stuck generators in reapStaleSessions (@ousamabenyounes)
- #1697 Circuit breaker on OpenClaw worker client (@ousamabenyounes)
- #1696 Resolve Setup hook reference, warn on macOS-only binary (@ousamabenyounes)
- #1693 Session lifecycle guards to prevent runaway API spend (@ousamabenyounes)
- #1692 Resolve Gemini CLI 0.37.0 session capture failures (@ousamabenyounes)

**Cross-platform & hooks**
- #1833 Replace hardcoded nvm/homebrew PATH with login-shell resolution (@masak1yu)
- #1781 Filter empty-string args before Bun spawn() (@biswanath-cmd)
- #1780 Fix npx search, default Codex context to workspace-local AGENTS (@enma998)

**Data integrity**
- #1820 Use parent project name for worktree observation writes (@0xLeathery)
- #1771 Exclude primary-key index from unique-constraint check in migration 7 (@derjochenmeyer)
- #1770 Restrict ~/.claude-mem/.env permissions to 0600 (@derjochenmeyer)
- #1729 Preserve targeted file reads and invalidate on mtime (@quangtran88)
- #1776 Coerce corpus route filters (@suyua9)

• 52 new commit(s) since last check
• Latest: 1d75006 — chore: bump version to 12.1.2
• Recent commits:
• 1d75006 chore: bump version to 12.1.2
• 05232ff fix: reap stuck generators in reapStaleSessions (fixes #1652) (#1698)
• b411d91 fix: add circuit breaker to OpenClaw worker client (#1636) (#1697)
• 4538e68 fix: resolve Setup hook broken reference and warn on macOS-only binary (#1547) (#1696)
• f97c50b fix: session lifecycle guards to prevent runaway API spend (#1590) (#1693)

playwright-mcp

• 1 new commit(s) since last check
• Latest: f370346 — feat(mcp): default extension protocol to v1 for backwards compatibility (#1545)
• Recent commits:
• f370346 feat(mcp): default extension protocol to v1 for backwards compatibility (#1545)
• 60a1465 test(extension): exercise both protocol v1 and v2 via projects (#1544)
• d378215 chore(deps-dev): bump @hono/node-server from 1.19.10 to 1.19.13 (#1527)
• 3b7ac70 chore(deps-dev): bump hono from 4.12.7 to 4.12.12 (#1528)
• 8f8f8cd feat(extension): support multiple tabs over a single connection (#1535)

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Check if Playwright MCP API or capabilities have changed
• Check if claude-mem MCP tool names or hook schema have changed
• Check if UI UX Pro Max, n8n-MCP, VoiceMode, Everything Claude Code, LightRAG, or Karpathy Skills have breaking changes
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

everything-claude-code

• 3 new commit(s) since last check
• Latest: 1a50145 — Merge pull request #1462 from affaan-m/fix/remove-legacy-ecc-install-refs
• Recent commits:
• 1a50145 Merge pull request #1462 from affaan-m/fix/remove-legacy-ecc-install-refs
• eb900dd test: align hook install expectations with Claude schema
• ccecb0b fix: restore string hook commands for Claude Code schema
• 9fb88c6 Merge pull request #1449 from affaan-m/fix/bash-hook-dispatcher-forkstorm-clean
• 6b7bd71 fix: relax pnpm strict build checks in CI

superpowers

• 2 new commit(s) since last check
• Latest: c4bbe65 — Some terminology cleanups
• Recent commits:
• c4bbe65 Some terminology cleanups
• 34c17ae sync-to-codex-plugin: seed interface.defaultPrompt (#1180)
• f9b088f Merge pull request #1165 from obra/mirror-codex-plugin-tooling
• bc25777 sync-to-codex-plugin: anchor EXCLUDES patterns to source root
• bcdd7fa sync-to-codex-plugin: exclude assets/, add --bootstrap flag

karpathy-skills

• 3 new commit(s) since last check
• Latest: c9a44ae — Update README with project and social media links
• Recent commits:
• c9a44ae Update README with project and social media links
• 331a3ac Update README with project and social media links
• 9ec6bef Fix readme
• fb8fdb0 Add Multica project link at the top of README (#51)
• aa4467f Merge pull request #18 from back1ply/fix/plugin-skill-path

voicemode

• New release: v8.6.0 (was v8.5.1)
• Release notes:

### Added

- **Auto-focus tmux pane on converse** (VM-922) -- Set `VOICEMODE_AUTO_FOCUS_PANE=true` to automatically focus the agent's tmux pane when converse acquires the conch. Supports multi-session setups via `switch-client`, and respects a `focus-hold` sentinel so other tools (e.g. show-me) can temporarily suppress focus changes. New `VOICEMODE_FOCUS_HOLD_SECONDS` setting. See the Multi-Agent Voice section in the configuration guide.
- **Restored `voicemode connect auth` CLI commands** (VM-992) -- `voicemode connect auth login`, `logout`, and `status` are back after the VM-958 legacy cleanup. `login` opens an Auth0 browser flow (or prints the URL with `--no-browser`); `status` shows account, token expiry, and refresh state.

### Fixed

- **ESC during converse no longer kills the MCP server** (VM-1026, [#337](https://github.com/mbailey/voicemode/issues/337), [#339](https://github.com/mbailey/voicemode/pull/339)) -- Pressing ESC while a `converse` call was in flight used to take the entire voicemode MCP server offline, requiring `/mcp` reconnect. The tool now catches `CancelledError`, cleans up audio state, and returns control to Claude without bringing the server down.
- **Circular import in changelog/release_notes under pytest 9** -- Deferred `voice_mode.resources.changelog` import inside `release_notes_prompt` so `tests/test_changelog_resource.py` collects cleanly under pytest 9's stricter import rules. No behavioural change; the resource is still registered at import time.
- **Star notification failures on multiline bios** -- GitHub user bios containing newlines no longer break the star notification script.

### Changed

- **Channel server extracted to its own plugin** -- The bundled `channel/` TypeScript server has been removed from this repo and now lives at [mbailey/voicemode-channel](https://github.com/mbailey/voicemode-channel). Install with `claude plugin install voicemode-channel@mbailey` to receive inbound voice calls from phone or web app clients.

### Removed

- **Legacy VoiceMode Connect Python integration** (VM-958) -- Removed the Python-based WebSocket client, agent registry, inbox symlinks, and filesystem message delivery that pre-dated the Claude Code channel system. Superseded by the `voicemode-channel` plugin.
  - Deleted: `voice_mode/connect/`, `voice_mode/connect_registry.py`, `voice_mode/tools/connect_status.py`, 10 Connect hook scripts + JSON configs, 11 Connect test files, `docs/connect/`, Connect service templates.

• 12 new commit(s) since last check
• Latest: 27e7313 — chore: bump version to 8.6.0 for all packages
• Recent commits:
• 27e7313 chore: bump version to 8.6.0 for all packages
• a739f7a Merge pull request #339 from mbailey/fix/VM-1026-esc-during-converse-tool-call-disconnects-mcp
• db5d324 fix: catch CancelledError in converse to keep MCP server alive (VM-1026)
• 0139d8e Merge branch 'cora/vm-922-auto-focus-pane'
• 4186c94 Merge branch 'cora/fix-pytest9-circular-import'

playwright-mcp

• 1 new commit(s) since last check
• Latest: 26e16d6 — chore(extension): connection warning (#1550)
• Recent commits:
• 26e16d6 chore(extension): connection warning (#1550)
• f370346 feat(mcp): default extension protocol to v1 for backwards compatibility (#1545)
• 60a1465 test(extension): exercise both protocol v1 and v2 via projects (#1544)
• d378215 chore(deps-dev): bump @hono/node-server from 1.19.10 to 1.19.13 (#1527)
• 3b7ac70 chore(deps-dev): bump hono from 4.12.7 to 4.12.12 (#1528)

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Check if Playwright MCP API or capabilities have changed
• Check if claude-mem MCP tool names or hook schema have changed
• Check if UI UX Pro Max, n8n-MCP, VoiceMode, Everything Claude Code, LightRAG, Karpathy Skills, or Caveman have breaking changes
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

context7

• 1 new commit(s) since last check
• Latest: abf293e — Add Hermes Agent guide to MCP clients docs (#2462)
• Recent commits:
• abf293e Add Hermes Agent guide to MCP clients docs (#2462)
• 0627b71 CTX7-1531: Create kiro power (#2456)
• c850669 chore(release): version packages (#2453)
• 3f6e310 fix: skill installation path check compatibility for Windows (#2441)
• c31528d chore(release): version packages (#2433)

lightrag

• 8 new commit(s) since last check
• Latest: a5a3c5a — Merge pull request #2948 from HKUDS/dependabot/bun/lightrag_webui/vite-8.0.0
• Recent commits:
• a5a3c5a Merge pull request #2948 from HKUDS/dependabot/bun/lightrag_webui/vite-8.0.0
• 16e1f2e Merge pull request #2947 from HKUDS/dependabot/bun/lightrag_webui/frontend-minor-patch-94be095972
• be8666e chore(deps-dev): bump vite from 7.3.2 to 8.0.0 in /lightrag_webui
• aa1ba80 Merge pull request #2946 from HKUDS/dependabot/bun/lightrag_webui/build-tools-39061e976e
• fa56c96 Merge pull request #2945 from HKUDS/dependabot/bun/lightrag_webui/react-773019ed67

vercel-agent-skills

• 2 new commit(s) since last check
• Latest: ce3e64e — Merge pull request #231 from tonypan2/tonypan/vercel-cli-sp-awareness
• Recent commits:
• ce3e64e Merge pull request #231 from tonypan2/tonypan/vercel-cli-sp-awareness
• 77a6a14 vercel-cli-with-tokens: fix 5 real bugs + document Stripe Projects plan changes
• 47863b2 Merge pull request #227 from vercel-labs/shu/rBVLn
• dc8367e update example
• 6938f37 Merge pull request #226 from vercel-labs/shu/vPV6R

superpowers

• 4 new commit(s) since last check
• Latest: b557648 — formatting
• Recent commits:
• b557648 formatting
• 9f42444 formatting
• 99e4c65 reorder installs
• a5dd364 README updates for Codex, other cleanup
• c4bbe65 Some terminology cleanups

n8n-mcp

• New release: v2.47.12 (was v2.47.8)
• Release notes:

# Release v2.47.12

Generating release notes from v2.47.11 to HEAD
### 🐛 Bug Fixes

- Staging QA report — 9 fixes + 1 deferred (v2.47.12) (#735) (7b3ccb1)

---

**Release Statistics:**
- 1 commit
- 1 contributor
- Contributors: Romuald Członkowski

---

## Installation

### NPM Package
```bash

• 5 new commit(s) since last check
• Latest: 7b3ccb1 — fix: staging QA report — 9 fixes + 1 deferred (v2.47.12) (#735)
• Recent commits:
• 7b3ccb1 fix: staging QA report — 9 fixes + 1 deferred (v2.47.12) (#735)
• ef9a856 Merge commit from fork
• 1d6a370 docs: add STRIDE threat model (#734)
• b055156 fix: add projectId and require columns for n8n_manage_datatable createTable (v2.47.10, #731) (#733)
• 5b1107b chore: update n8n to 2.16.1 and bump version to 2.47.9 (#732)

claude-mem

• New release: v12.1.6 (was v12.1.5)
• Release notes:

## Fix

**Critical regression fix (#2049): observations no longer save on Claude Code 2.1.109+**

Resolves 1000bservation/summary failure on Claude Code 2.1.109+ caused by a latent bug in how the bundled Agent SDK emits the `--setting-sources` flag.

### Root cause

The Agent SDK emits `["--setting-sources", ""]` whenever `settingSources` defaults to `[]`. Our existing Bun-compat filter stripped the empty string but left an orphan `--setting-sources` flag, which then consumed the following `--permission-mode` as its value. Claude Code 2.1.109+ rejects this with:

Error processing --setting-sources:
Invalid setting source: --permission-mode.

Every observation SDK spawn crashed with exit code 1 before any data could be written.

### Fix

`ProcessRegistry.createPidCapturingSpawn` now uses a pair-aware filter: when an empty-string arg follows a `--flag`, both are dropped together. The SDK default (no setting sources) is preserved by omission.

• 3 new commit(s) since last check
• Latest: 53622b5 — docs: update CHANGELOG.md for v12.1.6
• Recent commits:
• 53622b5 docs: update CHANGELOG.md for v12.1.6
• 69080dc chore: bump version to 12.1.6
• c76a439 fix: drop orphan flag when filtering empty-string spawn args (#2049)
• 70a150d docs: update CHANGELOG.md for v12.1.5
• d7b4610 chore: bump version to 12.1.5

playwright-mcp

• 6 new commit(s) since last check
• Latest: 3323673 — fix(extension): don't add status page to tab group when not connected (#1557)
• Recent commits:
• 3323673 fix(extension): don't add status page to tab group when not connected (#1557)
• 8f27739 fix(extension): notify connect page when pending connection is closed (#1556)
• 01adf2d fix(extension): throw clear error for tab creation in protocol v1 (#1555)
• d5d1942 chore(extension): rename Playwright MCP Bridge to Playwright Extension (#1554)
• a2b2d99 test(extension): cover browser_tabs close and select, extract tab-related suites (#1553)

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Check if Playwright MCP API or capabilities have changed
• Check if claude-mem MCP tool names or hook schema have changed
• Check if UI UX Pro Max, n8n-MCP, VoiceMode, Everything Claude Code, LightRAG, Karpathy Skills, or Caveman have breaking changes
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.

[github-actions]

Upstream Dependency Updates

The following upstream repos have new changes that may affect Maestro:

context7

• 1 new commit(s) since last check
• Latest: a1a935c — Update Kiro install config and docs (#2474)
• Recent commits:
• a1a935c Update Kiro install config and docs (#2474)
• abf293e Add Hermes Agent guide to MCP clients docs (#2462)
• 0627b71 CTX7-1531: Create kiro power (#2456)
• c850669 chore(release): version packages (#2453)
• 3f6e310 fix: skill installation path check compatibility for Windows (#2441)

claude-mem

• New release: v12.2.0 (was v12.1.6)
• Release notes:

## Highlights

**Worktree Adoption** — When a git worktree is merged back into its parent branch, its observations are now consolidated into the parent project's view, so memory follows the code after a merge.

## Features

- **Worktree adoption engine** — consolidates merged-worktree observations under the parent project (#2052)
- **`npx claude-mem adopt`** — new CLI command with `--dry-run` and `--branch X` flags for manual adoption
- **Auto-adoption on worker startup** — merged worktrees are adopted automatically when the worker service starts
- **CWD-based project remap** — project identity derived from `pending_messages.cwd`, applied on worker startup
- **Parent + worktree read scope** — worktree sessions now include parent repo observations in their read scope
- **Composite project names** — parent/worktree naming prevents observations from crossing worktrees
- **Merged-into-parent badge** — UI now flags observations that have been adopted from a merged worktree
- **Observer-sessions project hidden** — internal bookkeeping project no longer appears in UI lists

## Fixes

- Drop orphan flag when filtering empty-string spawn args (#2049)
- Self-heal Chroma metadata on re-run
- Schema guard, startup adoption path, and query parity hardening

• 24 new commit(s) since last check
• Latest: beea789 — chore: remove conductor.json shim
• Recent commits:
• beea789 chore: remove conductor.json shim
• a1741f4 docs: update CHANGELOG.md for v12.2.0 + make generator incremental
• 11666e9 chore: bump version to 12.2.0
• fb8e526 Merge pull request #2052 from thedotmack/thedotmack/worktree-remap
• b8d63d9 fix(worktree): self-heal Chroma metadata on re-run

---

Action Required

Review these changes and determine if Maestro needs updating:

• Check if new superpowers skills should be orchestrated
• Check if Context7 API has changed
• Check if new Vercel agent skills are available
• Check if Playwright MCP API or capabilities have changed
• Check if claude-mem MCP tool names or hook schema have changed
• Check if UI UX Pro Max, n8n-MCP, VoiceMode, Everything Claude Code, LightRAG, Karpathy Skills, or Caveman have breaking changes
• Update SKILL.md if needed
• Update checklists if needed
• Bump version in plugin.json if changes made

This issue was automatically created by the upstream tracker workflow.